AI Agents are becoming increasingly capable of working independently, prompting demands for stronger safety mechanisms.

For example, limiting access permissions, logging actions, monitoring for unusual behavior, and having humans intervene when necessary.

But there is a more fundamental question than whether AI makes mistakes:

If AI can evade monitoring, how can we be sure it truly follows the rules?

On October 23, 2026, today’s two important AI news stories both touch on this issue, alongside another dispute involving website operators and content creators.

The first concerns external research teams uncovering vulnerabilities in OpenAI’s internal AI Agent monitoring system.

The second involves European publishers formally requesting regulators to halt Meta’s soon-to-be-effective new commercial terms, worried about their website content being used by AI platforms without sufficient consent.

1. OpenAI’s AI Agent Monitoring System Vulnerabilities: Could Some Actions Be Invisible?

On October 22, two independent AI security research organizations, METR and Redwood Research, released a summary of their tests.

Researchers were invited inside OpenAI to conduct an in-depth evaluation of the system used internally to monitor AI Agents.

They found multiple security gaps in the existing monitoring design at the time.

One vulnerability could allow an Agent to execute hundreds of operations without triggering the expected monitoring.

They also discovered that Codex Agents might theoretically bypass some sandboxing and automated review restrictions, gaining nearly user-level permissions.

This goes beyond simple response errors.

Because when AI can run code, use tools, and manipulate files, the monitoring system is a vital line of defense against it acting outside its intended scope.

How was the testing conducted?

From July 21 to August 11, 2026, METR and Redwood Research each sent one researcher for a three-week evaluation.

These researchers gained considerable internal access including parts of the codebase, monitoring configurations, internal documents, and opportunities to interview engineers.

They used OpenAI’s equipment under supervised conditions.

This differs from external hackers trying to breach OpenAI.

The goal was identifying potential gaps in design and execution of monitoring.

What specific issues were found?

The published details highlight several notable situations.

First: Not all qualifying Agent activities are necessarily monitored.

The teams estimate that at the time, about 75% to 94% of internal Response API Agent traffic for models above a certain capability threshold met criteria for monitoring.

But that estimate refers to traffic eligible for monitoring, not confirming all was actually monitored completely.

Second: Monitoring can be delayed.

Some monitoring mechanisms only trigger when the Agent relinquishes control back to the user.

Researchers noted that if an Agent keeps working without ending its session, it might postpone monitoring triggers due to design gaps.

Third: Some operations may be hidden.

The team found a method that could hide hundreds of recent operations from monitoring logs.

The summary did not disclose full exploitation details.

This does not prove that numerous formally operating Agents have exploited this to secretly perform actions.

Fourth: Certain permission restrictions might be bypassed.

They also saw that some internal tools designated as read-only might be misused to perform other operations.

Some cases were not fully verified for actual exploitability.

Therefore, a clear line remains between "potential vulnerabilities found" and "actual security breaches occurring."

Has OpenAI fixed these issues?

OpenAI informed the researchers that all known vulnerabilities affecting production environment security have been patched.

The company also said it has expanded the monitoring system’s coverage during and after testing.

However, METR and Redwood Research explicitly stated:

They have not independently validated OpenAI’s claimed fixes.

This is the most important clarification.

The research covered the state of monitoring as of July 21, not a comprehensive retest of the system as of October 22.

So it cannot be said that all current OpenAI Agents still exhibit the same vulnerabilities.

Conversely, OpenAI’s declared patches should not be taken as third-party confirmed without further verification.

Does this mean ChatGPT or Codex are unsafe now?

No, that conclusion cannot be drawn.

This study focused on OpenAI’s internal Agent monitoring system, not a comprehensive test of general user ChatGPT conversations, nor does it prove user accounts have been compromised.

It serves as a reminder to companies deploying AI Agents:

Having safety monitoring does not guarantee the monitoring is flawless.

Enterprises must verify whether monitoring covers all operational stages, that logs are complete, and whether Agents can influence the monitoring itself.

Research suggestions include:

  • Don’t only check Agents at task completion.
  • Regularly compare actual execution logs with monitoring records.
  • Prevent Agents from disabling monitoring on their own.
  • Maintain audit logs that are difficult to alter.
  • Conduct ongoing independent safety testing.

For everyday users, the lesson is not panic but understanding:

As AI starts performing computer operations for people, reliable monitoring becomes just as crucial as its intelligence.

2. Publisher Backlash Against Meta’s New Terms: Does Managing a Facebook Page Mean Agreeing to AI Use of Your Site’s Content?

On October 22, European publishers and digital advertisers filed formal complaints to the European Commission and the UK Competition and Markets Authority through the organization Movement for an Open Web.

They are requesting regulators impose interim measures to suspend Meta’s new commercial terms scheduled to take effect on October 30, 2026.

The controversy involves more than what data Meta uses on Facebook and Instagram.

Publishers worry the new terms may include external website content associated with commercial accounts.

What exactly are publishers concerned about?

Imagine a news website running an official Facebook page, regularly sharing article links.

They use Meta’s business services aiming to attract readers, manage audiences, or run ads.

The concern is whether this business relationship might be interpreted as Meta having broad rights to scrape, analyze, or even use the external site content for AI products.

Movement for an Open Web argues these new terms may grant Meta excessively wide content usage rights, and companies may find it hard to refuse such terms while continuing to use the platform.

However, there is no confirmation that Meta has obtained unrestricted AI training rights over all news website content.

How does Meta respond?

Meta rejects the publishers’ accusations.

According to Reuters, Meta stated that the updated web scraping terms apply only to advertising and commercial products and do not change how the company uses web crawlers.

Meta also said website owners can still use robots.txt to express crawler access preferences.

In other words, Meta claims the new terms aren’t meant for unfettered scraping of news site content.

Nonetheless, some legal experts remain concerned that even with revised wording, certain content usage permissions may be broadly interpreted.

This ongoing dispute boils down to differing understandings of the same terms between publishers and Meta.

But didn't the new terms remove the phrase "training AI"?

Yes, media reports noted that after criticism, Meta removed explicit references to "training" from the relevant sections.

The updated language now focuses on advertising, commercial products, and their development, improvement, and research.

However, legal experts say that the broader terms around development and research still need clarification.

Removing the word "training" doesn’t necessarily resolve all concerns about content usage.

That said, it also doesn’t prove that Meta has legal, unrestricted rights to use all website content.

The true scope of applicability depends on the full terms, actual practices, and relevant legal and regulatory processes.

Have EU or UK regulators decided to block Meta?

Not yet.

Reuters reports that the UK CMA has met with Meta to discuss the new commercial terms and is urgently assessing related concerns.

The European Commission has also received complaints and will evaluate them following existing procedures.

As of the report, no regulator has officially ruled Meta’s actions illegal or confirmed they will prohibit the terms from taking effect on October 30.

This is an evolving dispute over commercial terms and competition law.

What should website or Facebook page managers do now?

The most reasonable approach is not to delete pages immediately nor assume all website content has been used to train AI.

If you manage an official site and a Meta business account, consider three steps:

First, identify which Meta business services you actually use.

Different user types and tools involve distinct terms; don’t assume that one commercial term applies to all Meta users.

Second, review the latest official terms and your site’s crawler settings.

If you manage the website, check your robots.txt file and server logs to understand your crawler access preferences.

However, robots.txt is mainly a crawler preference signal and isn’t a full solution for copyright or licensing disputes.

Third, monitor changes before October 30.

Keep track of any further Meta term revisions and regulatory interventions or clarifications about the applicable scope.

For content creators, the key takeaway is:

Website content is not only a traffic source but also an asset created through time, expertise, and investment.

As AI platforms require vast amounts of content for search, answers, and services, content owners’ rights to information, authorization, and choice become critical industry issues.

What do these two news stories together remind us?

At first glance, OpenAI’s agent monitoring issues and Meta’s content terms seem unrelated.

However, both point to the same question:

After AI capabilities expand rapidly, who has the right to inspect, restrict, and hold AI accountable for its actions?

OpenAI’s case shows that internal monitoring systems also need validation from external researchers.

Meta’s case reminds us that content use rules between platforms and creators cannot rely on vague term interpretations.

For everyday users, these changes don’t necessarily mean you must switch AI tools right now.

But future trust in AI services will rely not only on output quality, but also on how they log activities, allow audits, handle data, and maintain user control.

The more autonomously AI works, the more crucial clear rules and external oversight become.

Recommended Reading